CVE-2021-4088 Blind SQL injection in DLP ePO extension
Remote authenticated attackers can inject SQL into the DLP ePO extension, leading to remote code execution and privilege escalation on the ePO server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-4088?
CVE-2021-4088 is a high-severity SQL injection vulnerability in McAfee,LLC McAfee Data Loss Prevention (DLP) ePO Extension, published on 24 Jan 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server with privilege escalation.
Weakness: CWE-89
Which versions are affected by CVE-2021-4088?
It affects 1 product.
Products include Mcafee Data Loss Prevention.
How do I fix CVE-2021-4088?
No fix has been published for CVE-2021-4088 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-4088 being exploited?
There is no known exploitation of CVE-2021-4088 in the wild and no public exploit code.
Other vulnerabilities in McAfee,LLC McAfee Data Loss Prevention (DLP) ePO Extension
- CVE-2020-7346 Privilege escalation in McAfee DLP Endpoint for Windows
- CVE-2020-7304 DLP ePO extension - Cross-site request forgery
- CVE-2020-7305 DLP ePO extension - Privilege escalation
- CVE-2020-7302 DLP ePO extension - Unrestricted Upload of File with Dangerous Type
- CVE-2021-31832 Cross site scripting vulnerability in DLP Endpoint for Windows
Sources
Also known as GHSA-h23x-m73w-q96c.